fix(policy): harden authorization for plan resources

CHANGELOG.md

@@ -1,7 +1,8 @@
 # Changelog
 
 ## v5.0.3
-- Patch API token auth to check user's status
+- Patch API token auth to check user's status [#3606](https://github.com/DMPRoadmap/roadmap/pull/3606)
+- fix(policy): harden authorization for plan resources [#3613](https://github.com/DMPRoadmap/roadmap/pull/3613)
 
 ## v5.0.2
 - Bump Ruby to v3.1.4 and use `.ruby-version` in CI

app/controllers/contributors_controller.rb

@@ -12,13 +12,13 @@ class ContributorsController < ApplicationController
 
   # GET /plans/:plan_id/contributors
   def index
-    authorize @plan
+    authorize @plan, :show?
     @contributors = @plan.contributors
   end
 
   # GET /plans/:plan_id/contributors/new
   def new
-    authorize @plan
+    authorize @plan, :edit?
     default_org = @plan.org.present? ? @plan.org : current_user.org
     @contributor = Contributor.new(plan: @plan, org: default_org)
   end

spec/controllers/contributors_controller_spec.rb

@@ -7,6 +7,7 @@
     @scheme = create(:identifier_scheme, name: 'orcid')
     @org = create(:org, managed: true)
     @plan = create(:plan, :creator, org: @org)
+    @unauthorized_plan = create(:plan)
     @user = @plan.owner
     @contributor = create(:contributor, plan: @plan, org: @org)
 
@@ -36,20 +37,46 @@
       sign_in(@user)
     end
 
-    it 'GET plans/:plan_id/contributors (:index)' do
-      get :index, params: { plan_id: @plan.id }
-      expect(response).to render_template(:index)
-      expect(assigns(:plan)).to eql(@plan)
-      expect(assigns(:contributors).length).to eql(1)
-      expect(assigns(:contributors).first).to eql(@contributor)
+    describe 'GET plans/:plan_id/contributors (:index)' do
+      it 'renders the index' do
+        get :index, params: { plan_id: @plan.id }
+        expect(response).to render_template(:index)
+        expect(assigns(:plan)).to eql(@plan)
+        expect(assigns(:contributors).length).to eql(1)
+        expect(assigns(:contributors).first).to eql(@contributor)
+      end
+
+      it 'denies access to an unauthorized plan' do
+        get :index, params: { plan_id: @unauthorized_plan.id }
+
+        expect(response).not_to render_template(:index)
+        expect(assigns(:contributors)).to eql(nil)
+
+        expect(response).to have_http_status(:redirect)
+        expect(response).to redirect_to(plans_url)
+        expect(flash[:alert]).to eq('You are not authorized to perform this action.')
+      end
     end
 
-    it 'GET plans/:plan_id/contributors/new (:new)' do
-      get :new, params: { plan_id: @plan.id }
-      expect(response).to render_template(:new)
-      expect(assigns(:plan)).to eql(@plan)
-      expect(assigns(:contributor).new_record?).to eql(true)
-      expect(assigns(:contributor).plan).to eql(@plan)
+    describe 'GET plans/:plan_id/contributors/new (:new)' do
+      it 'renders the new form' do
+        get :new, params: { plan_id: @plan.id }
+        expect(response).to render_template(:new)
+        expect(assigns(:plan)).to eql(@plan)
+        expect(assigns(:contributor).new_record?).to eql(true)
+        expect(assigns(:contributor).plan).to eql(@plan)
+      end
+
+      it 'denies access to an unauthorized plan' do
+        get :new, params: { plan_id: @unauthorized_plan.id }
+
+        expect(response).not_to render_template(:new)
+        expect(assigns(:contributor)).to eql(nil)
+
+        expect(response).to have_http_status(:redirect)
+        expect(response).to redirect_to(plans_url)
+        expect(flash[:alert]).to eq('You are not authorized to perform this action.')
+      end
     end
 
     it 'GET plans/:plan_id/contributors/:id/edit (:edit)' do